Glossary
Compliance terms, in plain English
46 terms from SOC 2, ISO 27001, HITRUST, ISO 42001 and the EU AI Act, explained the way we’d explain them on a call.
- AI impact assessmentISO 42001
- An analysis of how an AI system could affect people, groups and society, required by ISO 42001 (clause 6.1.4) and useful under the EU AI Act.
- AICPASOC 2
- The American Institute of CPAs. It sets the SOC 2 framework and the attestation standards. CPA firms, licensed by state boards, issue the reports.
- AIMS (AI Management System)ISO 42001
- The policies, roles, processes and controls an organization uses to develop, provide or use AI responsibly. ISO/IEC 42001 defines what one must contain.
- Annex AISO 27001
- The list of reference controls in ISO/IEC 27001:2022 (93 controls in four themes: organizational, people, physical, technological). You choose which apply through the Statement of Applicability.
- AttestationSOC 2
- An independent auditor’s written opinion about your controls. SOC 2 is an attestation report, not a certificate.
- Audit period / observation windowSOC 2
- The span of time a Type II report covers, typically 3–12 months, during which controls must operate and evidence must exist.
- AvailabilitySOC 2
- One of the five Trust Services categories: systems are available for operation as committed. Optional; add it if customers rely on your uptime.
- Bridge letterSOC 2
- A short letter from management covering the gap between the end of one SOC 2 period and the next report, so customers aren’t left without coverage.
- Business continuity plan (BCP)General
- How the business keeps operating through a major disruption, with recovery objectives and tested procedures.
- CAIQQuestionnaires
- The Cloud Security Alliance’s Consensus Assessments Initiative Questionnaire, a free standard security questionnaire for cloud providers.
- Certification bodyISO
- An accredited organization that audits against ISO standards and issues certificates (ISO 27001, ISO 42001). Separate from consultants who help you prepare.
- Complementary user entity controls (CUECs)SOC 2
- Controls your customers must operate on their side for your SOC 2 controls to be effective, listed in the report.
- ControlGeneral
- A policy, process or technical measure that reduces a risk. “Access reviews every quarter” is a control; “we care about security” is not.
- Corrective action plan (CAP)HITRUST
- A documented plan to fix gaps found during a HITRUST assessment, with owners and deadlines.
- CPA firmSOC 2
- A licensed public accounting firm. Only CPA firms can issue SOC 2 reports.
- e1 / i1 / r2HITRUST
- The three HITRUST assessment levels: e1 (essential cybersecurity), i1 (implemented leading practices) and r2 (risk-based, the most comprehensive).
- EU AI ActAI
- The European Union’s regulation on artificial intelligence. It classifies AI systems by risk and sets obligations that phase in from 2025 to 2028 (Annex III high-risk rules from 2 December 2027, Annex I from 2 August 2028).
- EvidenceGeneral
- The artifacts that prove a control operated: screenshots, logs, tickets, signed records. Auditors test evidence, not intentions.
- ExceptionSOC 2
- A deviation the auditor found: a control that did not operate as described. Exceptions are listed in the report; serious ones can lead to a qualified opinion.
- Gap assessmentGeneral
- A structured comparison of what you do today against what a framework requires, producing a list of gaps to close before the audit.
- HIPAAHealthcare
- The US law governing protected health information. It has no official certification, which is why HITRUST is often used as proof.
- HITRUST CSFHITRUST
- The HITRUST Common Security Framework, which harmonizes HIPAA, NIST, ISO and other requirements into one certifiable control set.
- Information security policyGeneral
- The top-level, leadership-approved document that sets the rules for protecting information. Usually the first thing an auditor asks for.
- Internal auditISO
- A review you run yourself (or hire someone independent to run) to check your management system works, required by ISO 27001 and ISO 42001 before certification.
- ISMSISO 27001
- Information Security Management System: the governed, continually improved program that ISO 27001 certifies, not just a set of controls.
- Management reviewISO
- A periodic meeting where leadership reviews the performance of the ISMS or AIMS and decides on improvements. Required and auditable.
- MFAGeneral
- Multi-factor authentication. Expected on every system that matters; auditors check it is enforced, not just available.
- MyCSFHITRUST
- HITRUST’s online platform where assessments are scoped, completed and submitted.
- NIST AI RMFAI
- The US National Institute of Standards and Technology’s voluntary AI Risk Management Framework, often used alongside ISO 42001.
- NIST CSF 2.0General
- A widely used cybersecurity framework organized into six functions: Govern, Identify, Protect, Detect, Respond, Recover.
- Penetration testGeneral
- An authorized simulated attack on your systems by security professionals. Many customers and auditors expect one annually.
- PHIHealthcare
- Protected health information: identifiable health data regulated under HIPAA.
- Qualified opinionSOC 2
- An auditor’s opinion that controls were effective except for specific, significant exceptions. Customers notice it.
- Readiness reviewGeneral
- A dry run before the real audit that confirms controls, evidence and documentation are ready. Also called a mock audit or a readiness assessment. Our free online readiness assessment is something else: a questionnaire you score yourself.
- Risk registerGeneral
- The living list of your identified risks, their ratings, owners and treatment decisions. Required by ISO 27001 and expected by SOC 2 auditors.
- SIGQuestionnaires
- The Shared Assessments Standardized Information Gathering questionnaire, a licensed, widely used vendor security questionnaire (SIG Lite and SIG Core).
- SOC 1 / SOC 2 / SOC 3SOC 2
- SOC 1 covers controls relevant to customers’ financial reporting. SOC 2 covers security and related criteria. SOC 3 is a public summary of a SOC 2.
- Stage 1 / Stage 2ISO
- The two audits in ISO certification: Stage 1 reviews documentation and readiness, Stage 2 tests that the system is implemented and effective.
- Statement of Applicability (SoA)ISO 27001
- The document that lists every Annex A control, whether it applies to you, and why. Central to an ISO 27001 audit.
- Surveillance auditISO
- The annual check-in audits in the two years between certification and recertification of a three-year ISO certificate.
- Tabletop exerciseGeneral
- A discussion-based rehearsal of an incident or outage scenario, used to test response plans without touching systems.
- Trust centerGeneral
- A public page where a company shows its security posture: certifications, policies, subprocessors and how to request documents.
- Trust Services Criteria (TSC)SOC 2
- The five categories of SOC 2 criteria: Security (required), Availability, Confidentiality, Processing Integrity and Privacy.
- Type I / Type IISOC 2
- Type I: controls are suitably designed at a point in time. Type II: controls operated effectively over a period. Most enterprise buyers eventually want Type II.
- vCISOGeneral
- Virtual Chief Information Security Officer: a part-time, outsourced security executive who owns strategy, compliance and reporting.
- Vendor risk managementGeneral
- Assessing and monitoring third parties that touch your data, from cloud providers to contractors. Expected by every framework here.
Stuck on a step? Ask us.
Book a free 30-minute consultation. Bring what you have so far and we will tell you what we would do next.